An issue was discovered in the Linux kernel 4.18 through 5.10.16, as used by Xen. The backend allocation (aka be-alloc) mode of the drm_xen_front drivers was not meant to be a supported configuration, but this wasn't stated accordingly in its support status entry.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in the Linux kernel 4.18 through 5.10.16, as used by Xen. The backend allocation     (aka be-alloc) mode of the drm_xen_front drivers was not meant to be a supported configuration, but this     wasn't stated accordingly in its support status entry. (CVE-2021-26934)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-47f53a940a advisory.

  - An issue was discovered in Xen 4.9 through 4.14.x. On Arm, a guest is allowed to control whether memory     accesses are bypassing the cache. This means that Xen needs to ensure that all writes (such as the ones     during scrubbing) have reached the memory before handing over the page to a guest. Unfortunately, the     operation to clean the cache is happening before checking if the page was scrubbed. Therefore there is no     guarantee when all the writes will reach the memory. (CVE-2021-26933)

  - An issue was discovered in the Linux kernel 4.18 through 5.10.16, as used by Xen. The backend allocation     (aka be-alloc) mode of the drm_xen_front drivers was not meant to be a supported configuration, but this     wasn't stated accordingly in its support status entry. (CVE-2021-26934)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-4c819bf1ad advisory.

  - An issue was discovered in Xen 4.9 through 4.14.x. On Arm, a guest is allowed to control whether memory     accesses are bypassing the cache. This means that Xen needs to ensure that all writes (such as the ones     during scrubbing) have reached the memory before handing over the page to a guest. Unfortunately, the     operation to clean the cache is happening before checking if the page was scrubbed. Therefore there is no     guarantee when all the writes will reach the memory. (CVE-2021-26933)

  - An issue was discovered in the Linux kernel 4.18 through 5.10.16, as used by Xen. The backend allocation     (aka be-alloc) mode of the drm_xen_front drivers was not meant to be a supported configuration, but this     wasn't stated accordingly in its support status entry. (CVE-2021-26934)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
223696	Linux Distros Unpatched Vulnerability : CVE-2021-26934	Nessus	Misc.	high
146913	Fedora 33 : xen (2021-47f53a940a)	Nessus	Fedora Local Security Checks	high
146901	Fedora 32 : xen (2021-4c819bf1ad)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2021-26934

high

Tenable Plugins

high

high

high